Files in B7334SYS on AS400- Security Breach?

Hi all,
Could those of you on an AS400 please go into library B7334SYS and let me know if you have any files beginning with QACX...? I am looking into a security breach and need to know how far it reaches. If you have them could you please tell me what OS level you are on, what Service Pack and Update package?
I'd really appreciate it. I'm hoping to talk JDE into encrypting the passwords in these files if they continue to use this method of processing... Please let me know if you are interested in also making that request.

Thank you,

Lori, I see one file that meets your criteria in the B7334SYS library. Our AS/400 is running V4R5 and the Enterprise server is JDE 5 ERP 8.0 with Update 5 and SP20.E1.

The file only contains one record that is readily legible. But, there are no encrypted passwords or anything in there. You've got my interest now. So, what is this all about please?

I don't see any files beginning with QACX* in my B7334SYS library.... David

hi,
we have these files,too.
and i find some this files in QGPL lib.
what make you think it is encrypted files ?

The files are not encrypted. I want to get JDE to make the password field in these files encrypted. When a job is submitted it creates these files in B7334SYS. If a job ends normally the file is deleted. If the job is canceled or if it is Waiting or Processing, you can look at the job on the AS400, see the file name, go to the library, look in the file and find the OW password for the person that has submitted this job. It's a very bad practice and I'm really surprised that they have done this... Anyone want to help me complain?
Thank you, Lori

I see about 30 QACX files but ours are in QGPL library. Our AS/400 is
running V5R1 and the Enterprise server is Xe Coexistence, Update 5,
SP19.D-E1.

Can these be deleted at anytime?

Grant.

ENT: AS400 V5R1 OW Xe Update 5 Coexistence SP19 D1
DEP: Win2000 SQL 7 SP3
JAS: Win2000 (pending)




The files are not encrypted. I want to get JDE to make the password
field in these files encrypted. When a job is submitted it creates
these files in B7334SYS. If a job ends normally the file is deleted.
If the job is canceled or if it is Waiting or Processing, you can look
at the job on the AS400, see the file name, go to the library, look in
the file and find the OW password for the person that has submitted this
job. It's a very bad practice and I'm really surprised that they have
done this... Anyone want to help me complain?Thank you, Lori
Lori
OW Xe SP20_L1 Update 4
AS400 V5R1
NT
Citrix
email: [email protected]
--------------------------
To view this thread, go to:
http://www.jdelist.com/ubb/showthreaded.php?Cat=&Board=OW&Number=48138

+ - - - - - - - - - - - - - - - - - - - - - - - -+
This is the JDEList One World« / XE mailing list/forum.
Archives and information on how to SUBSCRIBE, and
UNSUBSCRIBE can be found on the JDEList Forum at
http://www.JDEList.com

JDEList is not affiliated with JDEdwards«

+ - - - - - - - - - - - - - - - - - - - - - - - -+



AS400 V5R1 Coexist CO-Win2000 NT Xe SP19 D1

We have several QACX.. files in both B7334SYS and QGPL. Although I didn't see any passwords - any idea how I could see them. They looked quite harmless.

/Philip

I didn't have any QACX files that I could find but if you do Work With
Active Jobs, Pull up a report that is Running, do a 5-Work With, then do
a 10-Display Job Log, it will show you the "Username" , "Password" on
there as well!

-Josh

I see the files in B7333SYS.
1) I see a password, but nothing associated with it to tell you whose password
2) Secure that library (and all other libraries) according to JDE's specifications and you should not have a problem with anybody seeing the file/data. (SETOWAUT)

Hi Jean,

A bit hard to secure when you have people on doing all kinds of
conversions, setup, etc. They need access to everything. After awhile
I'll be able to secure the production system but can't completely for
now.

Lori [emsmilep.gif]
OW Xe SP20_I1 Update 4
Two AS400s V5R1 (with LPARs on each)
NT Citrix
email: [email protected]

They are harmless as long as you have no one around that knows how to
look at queues, wrkactjob, etc. and doesn't have access to a JDE login
screen.

Lori [emsmilep.gif]
OW Xe SP20_I1 Update 4
Two AS400s V5R1 (with LPARs on each)
NT Citrix
email: [email protected]

Hi Bee!

no, they are not encrypted but the password field in the files in
B7334SYS should be changed to be encrypted... see the reply I did to
one of the other posts out there for more explaination. Thanks!

Lori [emsmilep.gif]
OW Xe SP20_I1 Update 4
Two AS400s V5R1 (with LPARs on each)
NT Citrix
email: [email protected]

Hi Josh, that is another problem but it can be resolved easily by a
setting in the jde.ini file.

Lori [emsmilep.gif]
OW Xe SP20_I1 Update 4
Two AS400s V5R1 (with LPARs on each)
NT Citrix
email: [email protected]

Hi Cuz!

Saw the whole posting here. Did find them also in qgpl but those made less sense than those in b7333sys.

Then I saw some light and remembered that we use Unified Logon so for us here it's not a real problem as they never use or change the password for oneworld itself but only for novell/nt

But if you find it a real problem just report it to JD and let's see what they think of it.

Enjoy the weekend!!

Hi Cuz,
I did report it and they are creating a SAR to do a change of some sort, maybe encrypting the password field in it. That would be best I think...

As soon as I know the SAR number I will broadcast it so others can request it also... only way to get them to up it on the development list!